Centre’s key cybersecurity agency secures access to Anthropic’s Mythos AI model

The Indian Computer Emergency Response Team (CERT-In), one of the country’s key cybersecurity agencies, has recently received access to Anthropic’s Claude Mythos artificial intelligence (AI) model, and is conducting small, controlled experiments on identifying software vulnerabilities, a senior government official said.

The experiments are being carried out on a limited scale because of concerns within CERT-In, which operates under the IT Ministry, over sharing sensitive information with a powerful AI model hosted on third-party servers. The agency is wary of exposing large volumes of potentially sensitive government and critical infrastructure data to a system over which it has limited direct control, the official said. As a result, the initial testing is being restricted to smaller datasets and controlled environments, rather than allowing the model to extensively scan sensitive systems.

Anthropic did not respond to an immediate request for comment.

The development comes amid CERT-In’s recent revelation that AI agents broke safety parameters and gained unauthorised access to sensitive data of Indian firms. The Indian Express reported that the AI agents belonged to Anthropic and OpenAI.

In June, this paper had also reported that CERT-In was among a select group of Indian government cybersecurity agencies in contention to receive access to Mythos, as part of Anthropic’s Project Glasswing initiative.

Launched in April, Project Glasswing is Anthropic’s initiative to give select cybersecurity organisations early access to its most powerful AI models to identify and fix vulnerabilities in critical software systems before malicious actors can exploit them.

Claude Mythos Preview, the model at the centre of the initiative, demonstrated unusually advanced cybersecurity capabilities, including the ability to autonomously discover previously unknown software vulnerabilities, known as zero-day vulnerabilities, and develop techniques to exploit them.

Story continues below this ad

According to Anthropic, the model had identified thousands of serious security flaws, including vulnerabilities in major operating systems and web browsers. In May, the company said it and its initial partners had discovered more than 10,000 high- or critical-severity vulnerabilities using the model.

Anthropic initially decided against making the model publicly available, warning that it could substantially lower the technical expertise required to discover and exploit weaknesses in widely used software systems.

Instead, the company restricted access to vetted organisations through Project Glasswing, whose initial partners included Microsoft, Google, Amazon Web Services, Apple, Cisco, and CrowdStrike. In June, Anthropic announced that it was expanding the initiative to approximately 150 additional organisations across more than 15 countries.

For India, access to Mythos could help government cybersecurity agencies identify weaknesses in systems underpinning critical sectors such as banking, telecom and power.

Story continues below this ad

Concerned about the potential impact that Mythos could have on critical infrastructure, Finance Minister Nirmala Sitharaman, in April, held a high-level meeting, along with IT Minister Ashwini Vaishnaw to assess risks posed by the powerful model to the country’s banking sector.

During the meeting, the banking sector was asked to take pre-emptive steps to safeguard their systems from the AI model. Sitharaman directed the Indian Banks’ Association (IBA) to develop a coordinated institutional mechanism to respond swiftly and effectively to any such threat. She also directed banks to engage the best available cybersecurity professionals and specialised agencies “to continuously strengthen the defensive and monitoring capabilities of the banks”.

On June 4, Financial Times reported that Anthropic is helping the US National Security Agency deploy Mythos for “offensive cyber operations, embedding engineers inside the agency.” FT quoted a source as saying that “Mythos would be useful for infiltrating the networks of nations such as China or Iran.” This comes despite the Silicon Valley start-up’s legal battle with the US Defence department, which includes the NSA.

Anthropic drew a red line around Claude AI models to restrict the US government’s use for mass surveillance of US citizens and lethal autonomous drones. That prompted a backlash, with the Pentagon calling the AI lab a “supply-chain risk”— a first for a US business. Anthropic has sued over this designation.